#BL602 "Boot2" ... The Boot Code that starts every BL602 Firmware ... Shall I unravel and document the code? 🤔

https://github.com/bouffalolab/bl_iot_sdk/tree/master/customer_app/bl602_boot2/bl602_boot2

My hunch: #BL602 Boot2 and ESP32 Secure Boot V2 have similar bootloader features 🤔

https://docs.espressif.com/projects/esp-idf/en/latest/esp32/security/secure-boot-v2.html

#BL602 Linker Map shows Boot2 Code is always loaded at 0x2300 0300 ... Let's find out what's inside

https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.1/sdk_app_blinky.map

When #BL602 boots, it runs the Boot2 Bootloader Firmware at 0x2300 0000 ... Which loads the Application Firmware into (yikes!) 0x2300 0000 ... Let's investigate how the Bootloader makes this self-overlay possible

https://github.com/lupyuen/bl_iot_sdk/blob/master/tools/flash_tool/bl602/builtin_imgs/blsp_boot2.map#L6884

Quick check of #BL602 Boot2 Disassembly ... To be sure that it matches the Boot2 Bootloader that we have been flashing to BL602. Great exercise for learning #RISCV Assembly! 👍

https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.2/bl602_boot2.S

#BL602 Bootloader installs the Application Firmware ... With eFuse Protection (optional)

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_boot2/bl602_boot2/blsp_boot2.c#L381-L507

How #BL602 Bootloader starts the Application Firmware

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_boot2/bl602_boot2/blsp_boot2.c#L509-L571

#BL602 Bootloader installs the Application Firmware

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_boot2/bl602_boot2/blsp_boot2.c#L271-L313

#BL602 Bootloader writes Application Firmware to XIP Flash Memory

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_boot2/bl602_boot2/blsp_boot2.c#L226-L269

Where does #BL602 Bootloader get the AES Encryption Key? From the eFuse Hardware!

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_boot2/bl602_boot2/blsp_port.c#L184-L209

Matching the #BL602 Bootloader Code ... With the Partition Table that's flashed to BL602 🤔

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_boot2/bl602_boot2/blsp_boot2.c#L226-L269

#BL602 Bootloader has a Table of ROM API Functions at 0x2201 0000 (ITCM) ... How is this table used? 🤔

https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.2/bl602_boot2.map

#BL602 Application Firmware also has a Table of ROM API Functions ... But it's located at 0x4200 C000 (DTCM) 🤔

https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.1/sdk_app_blinky.map

Linker Script for #BL602 Bootloader says that some System Functions will be placed in ITCM (0x2201 0000) ... Like Global Register (GLB), Power (PDS), XIP Flash and eFuse 🤔

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_boot2/bl602_boot2/blsp_boot2_flash.ld#L67-L95

Some parts of #BL602 Bootloader are located in ITCM Cache Memory (instead of XIP Flash) ... Maybe that's why the Bootloader is able to overwrite itself in XIP Flash Memory 🤔

https://github.com/lupyuen/bl_iot_sdk/releases/download/v8.0.2/bl602_boot2.map

Remember the Table of #BL602 ROM API Functions? Here's an interesting project that wraps the BL602 ROM API with #RustLang

https://github.com/9names/bl602-rom-wrapper/blob/main/src/rom_lookup.rs

#BL602 IoT SDK defines the ROM Driver API Functions at 0x2101 0800 ... Located in the BL602 Boot ROM

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_std/bl602_std/StdDriver/Inc/bl602_romdriver.h#L279

Now writing about the #BL602 Bootloader ... Then heading back to Rust Wrappers for BL602 IoT SDK

https://lupyuen.github.io/articles/boot?1

What is the #BL602 Boot2 Bootloader? How is it used for Secure Firmware Updates?

https://lupyuen.github.io/articles/boot?3

Inside the #BL602 Bootloader

https://lupyuen.github.io/articles/boot?4#inside-the-bootloader

#BL602 Bootloader loads our Application Firmware into XIP Flash Memory ... And starts the firmware

https://lupyuen.github.io/articles/boot?7#inside-the-bootloader

#BL602 Bootloader will rollback the Application Firmware in XIP Flash Memory when there's a problem

https://lupyuen.github.io/articles/boot?8#inside-the-bootloader

#BL602 Bootloader uses XZ Compression when installing Application Firmware

https://lupyuen.github.io/articles/boot?9#install-application-firmware

How #BL602 Bootloader copies our Application Firmware to XIP Flash Memory

https://lupyuen.github.io/articles/boot?10#write-firmware-to-xip-flash

What's inside the #BL602 Partition Table? How does it control the Bootloader?

https://lupyuen.github.io/articles/boot?12#bl602-partition-table

#BL602 Boot ROM ... What's Inside?

https://lupyuen.github.io/articles/boot?14#bl602-rom-driver-api

Here's how we discovered the #BL602 ROM Driver Functions in Boot ROM

https://lupyuen.github.io/articles/boot?15#locating-the-rom-driver-api

How #BL602 Bootloader starts our Application Firmware

https://lupyuen.github.io/articles/boot?23#start-the-firmware